Stack-Based Buffer Overflow in Kamailio ims_registrar_pcscf Module

Executive Summary

CVE-2026-106803 is a stack-based buffer overflow in Kamailio's ims_registrar_pcscf module affecting versions v6.1.3 and v6.1.4. The flaw occurs in the process_contact() function when handling crafted application/reginfo+xml NOTIFY messages. An attacker-controlled port value from the alias parameter is copied into a fixed 5-byte stack buffer without length validation, causing stack corruption and potential denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor Kamailio logs for crashes in the P-CSCF process after receiving NOTIFY messages with malformed alias parameters. Check for buffer overflow errors or segmentation faults in logs. Use network traffic analysis tools like Wireshark to inspect SIP messages for unusually long port values in the alias parameter of application/reginfo+xml NOTIFY messages.

Useful 0 Not Useful 0

Impact Analysis

An unauthenticated remote attacker can exploit this to crash the P-CSCF process by sending a specially crafted NOTIFY message. This results in denial of service, terminating the P-CSCF worker process and potentially the entire P-CSCF container with a single packet. The attack requires no authentication and can be triggered remotely via UDP.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service by crashing the P-CSCF process, which could disrupt VoIP services. It does not directly impact data confidentiality or integrity required by GDPR or HIPAA. However, prolonged service disruption may affect availability, a key aspect of compliance under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Kamailio to a patched version that includes the fix for CVE-2026-106803. If upgrading is not possible, disable the ims_registrar_pcscf module or set subscribe_to_reginfo=0 in the configuration to prevent processing of reginfo NOTIFY messages. Apply network-level mitigations such as filtering malformed SIP traffic at the firewall.

Useful 0 Not Useful 0